CVE-2021-38991
📋 TL;DR
This vulnerability allows a non-privileged local user on affected IBM AIX and VIOS systems to exploit a flaw in the lscore command, potentially leading to arbitrary code execution with elevated privileges. It affects IBM AIX versions 7.0, 7.1, 7.2 and VIOS 3.1. The attacker must have local access to the system to exploit this vulnerability.
💻 Affected Systems
- IBM AIX
- IBM VIOS
📦 What is this software?
Aix by Ibm
Aix by Ibm
Aix by Ibm
⚠️ Risk & Real-World Impact
Worst Case
A local attacker gains root privileges and full control of the system, enabling data theft, persistence, lateral movement, and complete system compromise.
Likely Case
A local user with standard privileges escalates to root access, allowing them to install malware, modify system configurations, or access sensitive data.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained, limiting impact to the affected system only.
🎯 Exploit Status
Exploitation requires local user access but no special privileges. The vulnerability is in a standard system command, making exploitation straightforward for attackers with local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AIX: APAR IJ29938; VIOS: APAR IJ29939
Vendor Advisory: https://www.ibm.com/support/pages/node/6538952
Restart Required: Yes
Instructions:
1. Download the appropriate APAR from IBM Fix Central. 2. Install the patch using smit or installp command. 3. Reboot the system to complete the installation.
🔧 Temporary Workarounds
Remove execute permissions from lscore
aixTemporarily remove execute permissions from the vulnerable lscore command to prevent exploitation while awaiting patching.
chmod -x /usr/sbin/lscore
Restrict access to lscore
aixUse AIX role-based access control to restrict which users can execute the lscore command.
chuser roles=restricted_user username
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts and monitor for suspicious activity
- Deploy endpoint detection and response (EDR) solutions to detect privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if system is running AIX 7.0, 7.1, 7.2 or VIOS 3.1 and has not applied the relevant APAR.Check Version:
oslevel -sVerify Fix Applied:
Verify APAR IJ29938 (AIX) or IJ29939 (VIOS) is installed using 'instfix -ik IJ29938' or check with 'oslevel -s'.📡 Detection & Monitoring
Log Indicators:
- Unusual lscore command execution patterns
- Privilege escalation attempts in audit logs
- Unexpected process creation with elevated privileges
Network Indicators:
- None - this is a local exploit
SIEM Query:
Search for 'lscore' command execution followed by privilege escalation patterns or unusual process creation